CVE-2025-1379 is a medium severity SQL injection flaw (CVSS 6.3) in code-projects Real Estate Property Management System 1.0, affecting the report page /Admin/CustomerReport.php, through the city argument. No fixed version is listed, so cut exposure and check the vendor for a patch.
What's affected
The affected component is the report page /Admin/CustomerReport.php, through the city argument. The CVE record says an attacker can manipulate that argument to alter the SQL the application sends to its database, and that the attack can be launched remotely.
Affected version: 1.0. The record names no fixed version or vendor patch, so check the vendor site before assuming one exists.
The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The attack vector is the network, and the vector lists low privileges required, so an attacker needs some kind of valid account first. The weakness classes are CWE-74, CWE-89.
The CVE record states that the exploit has been disclosed publicly. That is not the same as exploitation in the wild, which the record does not report, and the CISA Known Exploited Vulnerabilities flag is false. Still, public details lower the effort needed to attack an exposed instance.
How to check if you're exposed
Start by finding out whether you run this software at all. It is a standalone web application, not a library you pull from a package registry, so a dependency scan will not list it. Search your hosts and web roots for the product name and the vulnerable file.
find /var/www -type f -name "CustomerReport.php" 2>/dev/null
grep -rnE "(mysql_query|mysqli_query|->query)\(" /var/www/PATH_TO_APP | head
The second command is only a starting point. It shows where the code builds queries, so you can see whether request values are placed straight into query strings. Then look at your web server logs for the vulnerable path and read through unusual values in the city parameter.
grep "CustomerReport.php" /var/log/nginx/access.log | grep -Ei "%27|union|sleep\(" | head
Adjust the log path for Apache or your own setup. A hit does not prove compromise, and a clean log does not prove safety, but it tells you where to look first.
What to do now
- Find every copy of code-projects Real Estate Property Management System in your estate, including test and demo servers that are easy to forget.
- Take the application off the public internet or put it behind a VPN or an IP allowlist until it is fixed.
- If you maintain the code, switch the affected query to a prepared statement with bound parameters and validate the city value on the server side.
- Check that the database account the application uses has only the privileges it needs. It should not be able to read other schemas or write files.
- Review logs for the vulnerable path, and rotate any credentials stored in that database if you see signs of abuse.
- Watch the vendor or project page for a patched release, and apply it when one appears.
Why it matters
SQL injection happens when user input ends up inside a database query as part of the query text, so the database cannot tell data from instructions. The weakness is catalogued as CWE-74, CWE-89, and CWE-89 is one of the oldest and best understood classes in web security. The fix is also well understood: keep data and query text separate by using parameterised queries, and never build SQL by joining strings.
Small PHP applications of this type are often written as teaching or sample projects and then deployed for real use. They rarely receive security review and often have no maintainer who ships patches. That is why the practical advice leans on reducing exposure instead of waiting for a vendor release.
Quick check
Does exploiting this need a valid account?
The CVSS vector for this record decides that, and The attack vector is the network, and the vector lists low privileges required, so an attacker needs some kind of valid account first. Even where an account is required, treat any internet-facing instance as reachable by anyone who can register or guess a password.
Is there a patch for code-projects Real Estate Property Management System?
The record names no fixed version or vendor patch, so check the vendor site before assuming one exists.
Sources
- Gold vulnerability page for CVE-2025-1379
- CVE record for CVE-2025-1379 as published by its CNA, with a published date of 2025-02-17
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
